{"id":"ASB-A-505067993","details":"In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible  policy desynchronization due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-505067993","CVE-2026-55262"],"modified":"2026-11-02T16:56:14.903328876Z","published":"2026-11-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-11-01"}],"affected":[{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-qpr2-next:0"},{"fixed":"17-qpr2-next:2026-11-01"}]}],"versions":["17-qpr2-next"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"id":"ASB-A-505067993-9c28fe93","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/577543980a006ea56dd3fbbb3e7e4d28bb0db4d8","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java","function":"setNotificationListenerAccessGrantedForUserInternal"},"deprecated":false,"digest":{"function_hash":"177451627907547070523621252875831939662","length":1194}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/577543980a006ea56dd3fbbb3e7e4d28bb0db4d8","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"line_hashes":["278745691919809360854153693686274713946","185656938617667471664028572188051753629","75978779350078412707991368963067374126","99814645763464290913885771135164226616"],"threshold":0.9},"id":"ASB-A-505067993-ccdacbd3","signature_type":"Line"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/577543980a006ea56dd3fbbb3e7e4d28bb0db4d8"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-505067993.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-11-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/frameworks/base/+/e844e46351d53ae6f8fb8d35dbfeb0677dc0dbf1","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["146242436295012419806337339958866653161","185656938617667471664028572188051753629","75978779350078412707991368963067374126","99814645763464290913885771135164226616"]},"id":"ASB-A-505067993-107bb783","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"148352648110322003019128251639532073655","length":1225},"id":"ASB-A-505067993-1a3132b0","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/e844e46351d53ae6f8fb8d35dbfeb0677dc0dbf1","target":{"function":"setNotificationListenerAccessGrantedForUser","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/e844e46351d53ae6f8fb8d35dbfeb0677dc0dbf1"],"severity":"High","spl":"2026-11-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-505067993.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-11-01"}]}],"versions":["16"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/80bee43622e6cf8ee89fe36a721350a0a089a9e2","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java","function":"setNotificationListenerAccessGrantedForUser"},"deprecated":false,"digest":{"function_hash":"240138501262676182444508959647016007451","length":1296},"id":"ASB-A-505067993-1856ca32","signature_type":"Function"},{"id":"ASB-A-505067993-a4f5b5f1","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/80bee43622e6cf8ee89fe36a721350a0a089a9e2","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["278745691919809360854153693686274713946","185656938617667471664028572188051753629","75978779350078412707991368963067374126","99814645763464290913885771135164226616"]}}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/80bee43622e6cf8ee89fe36a721350a0a089a9e2"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-505067993.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-11-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fd35fa62637c5cb2575996326b44ee9a19bbb2fa","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"line_hashes":["278745691919809360854153693686274713946","185656938617667471664028572188051753629","75978779350078412707991368963067374126","99814645763464290913885771135164226616"],"threshold":0.9},"id":"ASB-A-505067993-bc5ec9be"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/fd35fa62637c5cb2575996326b44ee9a19bbb2fa","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java","function":"setNotificationListenerAccessGrantedForUser"},"deprecated":false,"digest":{"function_hash":"98514933952219307677968431208261814333","length":1330},"id":"ASB-A-505067993-d991266a","signature_type":"Function"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/fd35fa62637c5cb2575996326b44ee9a19bbb2fa"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-505067993.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17:0"},{"fixed":"17:2026-11-01"}]}],"versions":["17"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["278745691919809360854153693686274713946","185656938617667471664028572188051753629","75978779350078412707991368963067374126","99814645763464290913885771135164226616"]},"id":"ASB-A-505067993-17786064","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/a6fc2d471a7529428330e9fbf2de5866fd449aef"},{"source":"https://android.googlesource.com/platform/frameworks/base/+/a6fc2d471a7529428330e9fbf2de5866fd449aef","target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java","function":"setNotificationListenerAccessGrantedForUserInternal"},"deprecated":false,"digest":{"length":1101,"function_hash":"157790974212425174168279966275364715533"},"id":"ASB-A-505067993-8579841b","signature_type":"Function","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/a6fc2d471a7529428330e9fbf2de5866fd449aef"],"severity":"High","spl":"2026-11-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-505067993.json"}},{"package":{"name":"platform/frameworks/base","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-11-01"}]}],"versions":["14"],"ecosystem_specific":{"severity":"High","spl":"2026-11-01","types":["EoP"],"vanir_signatures":[{"target":{"file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false,"digest":{"line_hashes":["82626712534338495975921566045102088679","116201476102771282999750737566044312877","75978779350078412707991368963067374126","99814645763464290913885771135164226616"],"threshold":0.9},"id":"ASB-A-505067993-7371f75d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1fe8763f3c9f71e0b752cbcfd0d907b8770ad3eb"},{"digest":{"length":1019,"function_hash":"89373110465803920719114809462447913870"},"id":"ASB-A-505067993-d3572bc9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/frameworks/base/+/1fe8763f3c9f71e0b752cbcfd0d907b8770ad3eb","target":{"function":"setNotificationListenerAccessGrantedForUser","file":"services/core/java/com/android/server/notification/NotificationManagerService.java"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/frameworks/base/+/1fe8763f3c9f71e0b752cbcfd0d907b8770ad3eb"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-505067993.json"}}],"schema_version":"1.9.2"}